gateway: Configure firewalld

Signed-off-by: David Galloway <dgallowa@redhat.com>

diff --git a/roles/gateway/defaults/main.yml b/roles/gateway/defaults/main.yml
index bbee709c9b5623545d815b2adae642251b533cb3..5fdb3fe89c0ceb4db0bd42db1b84928f58b051a4 100644 (file)
--- a/roles/gateway/defaults/main.yml
+++ b/roles/gateway/defaults/main.yml
@@ -9,3 +9,6 @@ secrets_repo:
 openvpn_server_name: server
 
 openvpn_data_dir: /etc/openvpn/data
+
+gw_allow_http: "true"
+gw_allow_https: "true"

diff --git a/roles/gateway/tasks/firewall.yml b/roles/gateway/tasks/firewall.yml
new file mode 100644 (file)
index 0000000..a72d849
--- /dev/null
+++ b/roles/gateway/tasks/firewall.yml
@@ -0,0 +1,60 @@
+---
+- name: Make sure iptables isn't running
+  service:
+    name: iptables
+    state: stopped
+    enabled: false
+  ignore_errors: true
+
+- name: Make sure firewalld is enabled
+  service:
+    name: firewalld
+    state: started
+    enabled: yes
+
+- name: firewalld | Allow openvpn traffic
+  firewalld:
+    service: openvpn
+    zone: public
+    state: enabled
+    permanent: true
+    immediate: yes
+
+- name: firewalld | Allow http traffic
+  firewalld:
+    service: http
+    zone: public
+    state: enabled
+    permanent: true
+    immediate: yes
+  when: gw_allow_http == "true"
+
+- name: firewalld | Allow https traffic
+  firewalld:
+    service: https
+    zone: public
+    state: enabled
+    permanent: true
+    immediate: yes
+  when: gw_allow_https =="true"
+
+# The following two tasks require Ansible v2.1 due to the 'masquerade'
+# and 'interface' parameters being new to that version.  They only need to be
+# run the first time the role is run so it's okay for them to be skipped.
+- name: firewalld | Add connection masquerading
+  firewalld:
+    masquerade: yes
+    zone: public
+    state: enabled
+    permanent: true
+    immediate: yes
+  when: "{{ ansible_version.major }} >= 2 and {{ ansible_version.minor }} >= 1"
+
+- name: firewalld | Add tun0 to internal zone
+  firewalld:
+    zone: internal
+    interface: tun0
+    state: enabled
+    permanent: true
+    immediate: yes
+  when: "{{ ansible_version.major }} >= 2 and {{ ansible_version.minor }} >= 1"

diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml
index 11a52a644873f97f0673806f359dbe2338866156..372fd87b89b205acfb9ee94840d2a673688a6ff6 100644 (file)
--- a/roles/gateway/tasks/main.yml
+++ b/roles/gateway/tasks/main.yml
@@ -15,6 +15,11 @@
   tags:
     - networking
 
+# Configure firewalld
+- include: firewall.yml
+  tags:
+    - firewall
+
 - name: Ensure data directory exists
   file:
     path: "{{ openvpn_data_dir }}"

diff --git a/roles/gateway/vars/packages.yml b/roles/gateway/vars/packages.yml
index 2d1f25fdb4b8fec3d0e3c698b4fc4c3d39cbf098..145afd6657d2f634989443adbf598777abe20164 100644 (file)
--- a/roles/gateway/vars/packages.yml
+++ b/roles/gateway/vars/packages.yml
@@ -10,7 +10,6 @@ packages:
   ## VPN-specific stuff
   - openvpn
   - easy-rsa
-  - iptables-services
   ## monitoring
   - nrpe
   - nagios-plugins-all